GitLab CE and EE Exploit Attempt - CVE-2021-22205

GitLab Community Edition (CE) and Enterprise Edition (EE) contain a vulnerability in how it validates an image file before sending it to the file parser tool, ExifTool. An attacker embeds a malicious command into a specifically designed file. The malicious command is preceded by a DjVu image header and a Perl qx { } operator. The qx { } operator facilitates running an external command and capturing output. (DjVu is a file format similar to the PDF file format.) The attacker sends an HTTP POST request with the specially designed file to an upload endpoint in GitLab. GitLab does not validate the image file content before sending it to ExifTool, which is written in Perl. ExifTool parses the file and runs the malicious command.